GET_V(nut->time_base[i].num, tmp > 0 && tmp < (1ULL << 31));
GET_V(nut->time_base[i].den, tmp > 0 && tmp < (1ULL << 31));
if (av_gcd(nut->time_base[i].num, nut->time_base[i].den) != 1) {
- av_log(s, AV_LOG_ERROR, "time base invalid\n");
+ av_log(s, AV_LOG_ERROR, "invalid time base %d/%d\n",
+ nut->time_base[i].num,
+ nut->time_base[i].den);
- return AVERROR_INVALIDDATA;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
}
}
tmp_pts = 0;
if (tmp_fields > 7)
tmp_head_idx = ffio_read_varlen(bc);
- while (tmp_fields-- > 8)
+ while (tmp_fields-- > 8) {
+ if (bc->eof_reached) {
+ av_log(s, AV_LOG_ERROR, "reached EOF while decoding main header\n");
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
+ }
ffio_read_varlen(bc);
+ }
- if (count == 0 || i + count > 256) {
+ if (count <= 0 || count > 256 - (i <= 'N') - i) {
av_log(s, AV_LOG_ERROR, "illegal count %d at %d\n", count, i);
- return AVERROR_INVALIDDATA;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
}
if (tmp_stream >= stream_count) {
- av_log(s, AV_LOG_ERROR, "illegal stream number\n");
+ av_log(s, AV_LOG_ERROR, "illegal stream number %d >= %d\n",
+ tmp_stream, stream_count);
- return AVERROR_INVALIDDATA;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
}
for (j = 0; j < count; j++, i++) {
for (i = 1; i < nut->header_count; i++) {
uint8_t *hdr;
GET_V(nut->header_len[i], tmp > 0 && tmp < 256);
- rem -= nut->header_len[i];
- if (rem < 0) {
- av_log(s, AV_LOG_ERROR, "invalid elision header\n");
+ if (rem < nut->header_len[i]) {
+ av_log(s, AV_LOG_ERROR,
+ "invalid elision header %d : %d > %d\n",
+ i, nut->header_len[i], rem);
- return AVERROR_INVALIDDATA;
+ ret = AVERROR_INVALIDDATA;
+ goto fail;
}
+ rem -= nut->header_len[i];
hdr = av_malloc(nut->header_len[i]);
- if (!hdr)
- return AVERROR(ENOMEM);
+ if (!hdr) {
+ ret = AVERROR(ENOMEM);
+ goto fail;
+ }
avio_read(bc, hdr, nut->header_len[i]);
nut->header[i] = hdr;
}